BENEFITS DIGEST

Mercer’s practitioner read of the Labor Department’s parity enforcement bulletin organizes FAB 2026-03 into three enforcement priorities and a red-flag list worth running against your own plan, age limits on applied behavior analysis therapy, exclusions of medication-assisted treatment for addiction, exclusions of residential treatment or intensive outpatient care, different telehealth restrictions for mental health and medical care, and network admission and payment methods that treat behavioral providers differently. It also catalogs which portions of the 2024 parity rule the agencies will not enforce for now, and notes the promise of a new proposed mental health parity rule by the end of 2026.

The FTC and the states have taken over where HIPAA stops on health data from website trackers. Goodwin's survey starts from the July action against telehealth platform Hims & Hers over tracking code that shared customer information with advertising platforms, and maps the wider landscape after a 2024 court ruling curbed HHS's position that tracking data from website visitors who are not logged in counts as protected health information. California wiretap and privacy statutes, Washington's My Health My Data Act, and more than 20 other state laws now regulate consumer health data outside HIPAA. Employers should check their wellness portals, benefits tools, and plan websites for tracking technology that shares information with advertising companies. HIPAA is not the only privacy law that may apply.

The New Jersey Legislature recently adopted two bills that extend and expand telehealth flexibilities regarding payors and controlled dangerous substances.